Considering the total available sample size and the limitation of our GPU and hardware memory, we run FedGAN on four clients where each client is trained on randomly equally sampled images from the datasets described above. This study serves as a first step towards understanding backdoor attacks and exploring defense strategies in FedGAN training for medical image synthesis. We contend scale of simulation is still significant and can easily be generalized to a larger scale. We update the local generator parameters to the global server every local epoch and train the FedGAN with 200 global epochs using FedAvg [1]}. The synthetic medical images with vanilla FedGAN (no attack and defense induced) are presented in Fig. REF  (b) for ISIC dataset and Fig. REF  (b) for ChestX dataset.
